Attention Drivers! Your Car is Watching You…

Article By : Mathew Arcoleo

One of the most vital areas of development for semi- and fully-autonomous vehicles is driver gaze and eye tracking, but there are several implementation challenges facing designers.

One of the most vital areas of development for semi- and fully-autonomous vehicles is driver gaze and eye tracking, but there are several implementation challenges facing designers. First among them is the broadly defined set of features that are needed to qualify an eye-tracking system as ASIL-B certified for Level 3 autonomous vehicles, which has resulted in a wide variety of ASIL features among chip vendors. This is especially true with image sensors, which are critical to the success of key functions like driver-state monitoring.

Obviously, image-sensor functionality is only one consideration when creating an eye-tracking system. The other critical piece is the algorithm that makes use of sensor data. Let’s take a closer look at what automotive designers need in order to ensure safe Level 3 operation of driver eye tracking for vision-based driver monitoring systems (DMSes) in autonomous vehicles.

Why Eye Tracking?Designers cite safety as the top reason for adding eye tracking; carmakers are looking to integrate eye-tracking technology into vehicles because driver drowsiness or inattentiveness can be detected and prevented before accidents occur. Eye tracking also enables driver identification, which can be used to create in-cabin comfort and information systems preference settings that operate without the driver even having to press a button (after initial setup). Most importantly, eye-tracking technology will become essential as we move up the autonomous levels.

Determining the ASIL RatingThe first question that needs to be answered in creating an eye-tracking system is, what ASIL rating is needed to meet current and future requirements? The safety level required for a sensor targeting automotive safety applications determines the features needed in that selected sensor. It’s also important to stay on top of trends that may impact future ASIL requirements, since sensors have a long life cycle in the automotive market. For eye tracking, a sensor’s application may include more safety-critical functions in the future, so it’s likely to require a higher ASIL certification.

Configurability and conformance with ASIL B/C allows the same sensor to be used in multiple applications across a line of automotive products with different technical requirements. Additionally, since development, verification, and maintenance consume such a large portion of automotive costs, a higher safety rating increases ROI while incurring no area or margin penalties.

We at Omnivision think ASIL B/C is the ideal rating for DMSes, because these systems are used both for autonomous driving and as a safety feature. For example, if other systems crash, or other safety features detect critical failure, the DMS must remain functional in order to alert the driver.

Achieving ASIL B/CTo achieve ASIL B/C for a DMS, the system’s image sensor must ensure that the image is not corrupted by noise, mirror/flip, row/column defects, or pixel defects. Additionally, the system must include safeguards to ensure the algorithm can trust the image content.

Specifically, the following DMS safety goals must be met:

The device shall not mirror the whole image or parts of the image in the horizontal or vertical direction.

The device shall not transfer images with the incorrect size in terms of rows and columns.

The device shall not send any data that is unprotected by a cyclical redundancy check (CRC) that includes the appropriate hamming distance.

Staying Ahead of the CurveTo stay on top of automotive safety requirements, it’s essential to review all the relevant standards and regulations, and to stay abreast of any updates. Additionally, it’s important to read the latest research and attend industry events, both to ensure compliance with current requirements and to predict future ones.

If organizations would like a voice in the standards being developed for the cars of tomorrow, we also recommend participating in the working groups that are defining them. For example, OmniVision tracks and contributes to the “ISO 26262 TC 22/SC 32 Working Group 8 – Functional Safety” and the MIPI Camera Working Group with specific focus on functional safety and cybersecurity. In doing so, organizations can apply all of this knowledge by developing and continually refining their own safety requirements.

Setting Safety RequirementsFor any potential failure of a defined function at the vehicle level, a HARA (hazard and risk analysis) helps to identify the intensity of the risk of harm to people and their property. Once this classification is completed, it assists in identifying the processes and the level of risk reduction needed to achieve a tolerable risk for any automotive system. Safety goal definitions, as required by ASIL, are then set for both hardware and software processes within the automotive design to ensure the highest levels of functional safety.

Two excellent tools that we recommend for developing component and subsystem safety definitions are FMEDA (failure modes, effects, and diagnostic analysis) and FTA (fault tree analysis). These tools allow designers to link all the technical safety requirements to the specific failure modes and effects, and then map them to the appropriate blocks. It’s also important to verify that the initial safety requirements are captured before the design of each DMS component or subsystem has a finalized safety plan.